Security tracker / CVE-2025-37820

CVE-2025-37820

xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 6c5aa6fc4def ("xen networking: add basic XDP support for
 carnil> xen-netfront"). Vulnerable versions: 5.9.

Bugs

Status

Branch	Status
upstream	released (6.15-rc4) [cc3628dcd851ddd8d418bf0c897024b4621ddc92]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.14-upstream-stable	released (6.14.5) [eefccd889df3b49d92e7349d94c4aa7e1ba19f6c]
6.12-upstream-stable	released (6.12.26) [d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9]
6.6-upstream-stable	released (6.6.89) [cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa]
6.1-upstream-stable	released (6.1.136) [5b83d30c63f9964acb1bc63eb8e670b9e0d2c240]
5.10-upstream-stable	needed
sid	released (6.12.27-1)
6.12-trixie-security	N/A "Fixed before branching point"
6.1-bookworm-security	released (6.1.137-1)
5.10-bullseye-security	needed